Response to information security incidents

All security incidents are addressed in a consistent manner to improve security based on what has happened.

In the incident treatment process:

• the reported incident is confirmed (or found unnecessary to record)
• the type and cause of incident is documented
• the risks associated with the incident are documented
• the risks are re-evaluated and treated if that is necessary after the incident
• risk mitigation measures or a decision their acceptance is documented
• people who need to be informed of the results of the incident treatment are identified (including external ones)
• possible need for a post-incident analysis is determined

Our organization has pre-defined procedures through which the detected security breach will be addressed. The process may include e.g. the following things:

• who are part of a team that is ready to respond to breaches
• how and along what channel the entire team is immediately notified of the breach
• the team determines the severity (low, medium, high) of the breach based on predefined criteria
• the breach management is continued with a larger group according to the severity level